CVE-2026-125099: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder

Q: What must an attacker provide to trigger the disclosure?

An attacker must supply a crafted GEM .img image that uses SKIP or pattern opcodes. The issue occurs when the GEM raster decoder copies uninitialized row-buffer bytes into decoded frames.

Q: When is an application exposed?

An application is exposed when it decodes attacker-controlled GEM .img files using the affected FFmpeg GEM raster decoder. The supplied data does not establish that merely having FFmpeg installed, without processing such images, is sufficient.

Q: What information can be disclosed?

Decoded frames can contain uninitialized heap memory from the row buffer, potentially exposing heap contents. The reported impact is information disclosure; no integrity or availability impact is specified.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the disclosure?

An attacker must supply a crafted GEM .img image that uses SKIP or pattern opcodes. The issue occurs when the GEM raster decoder copies uninitialized row-buffer bytes into decoded frames.

When is an application exposed?

An application is exposed when it decodes attacker-controlled GEM .img files using the affected FFmpeg GEM raster decoder. The supplied data does not establish that merely having FFmpeg installed, without processing such images, is sufficient.

What information can be disclosed?

Decoded frames can contain uninitialized heap memory from the row buffer, potentially exposing heap contents. The reported impact is information disclosure; no integrity or availability impact is specified.

CVE-2026-125099: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the disclosure?

When is an application exposed?

What information can be disclosed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the disclosure?

When is an application exposed?

What information can be disclosed?